Privacy Policy
UK GDPR & Data Protection Act 2018 Compliant · 17 September 2026
1. Data Controller & Data Processor Roles
Account & Billing Data: Omni Flow Limited (company number 16818227, registered office 128 City Road, London, EC1V 2NX, United Kingdom) acts as the Data Controller for your account details, billing history, and contact information. For privacy questions or to exercise your rights, write to privacy@myreceptionist.uk; we respond within 30 days. You may also complain to the Information Commissioner’s Office (ico.org.uk).
Caller Communications Data: When our AI receptionist answers inbound calls on your behalf, we act as a Data Processor carrying out processing under your instructions. You are the Data Controller with respect to your callers’ personal data.
2. Information We Collect
- Account Data: Email address, business name, owner name, contact mobile number, business address, and Companies House number (for telecom KYC).
- Payment Data: Payment details are securely collected and processed by Stripe. We do not store full payment card numbers on our servers.
- Call Recordings & Transcripts: Inbound voice audio, speech-to-text transcripts, and structured extracted summaries (name, phone number, enquiry notes).
- Technical Data: IP address, browser user-agent, session tokens, and webhook audit events.
3. Purpose & Legal Bases for Processing
- Service Delivery (Contract): Providing conversational call handling, generating transcripts, sending summaries via WhatsApp/SMS/email, and managing UK phone lines.
- Legal Obligation: Telecom KYC regulations (Ofcom regulations requiring identity verification for UK phone numbers) and HMRC accounting requirements.
- Legitimate Interests: Fraud detection, platform security, and preventing abuse of public demonstration endpoints.
4. Sub-Processors & International Data Transfers
We partner with trusted third-party providers to deliver telephony, AI, and hosting services:
| Provider | Role | Location / Safeguard |
|---|---|---|
| Supabase | Database & Authentication | London, United Kingdom (AWS eu-west-2) |
| Vercel Inc. | Application Hosting & Edge Compute | London, UK (lhr1) / UK-US Data Bridge |
| ElevenLabs Inc. | Voice Synthesis & Conversational AI | USA (UK-US Data Bridge / SCCs) |
| Twilio Inc. | UK Mobile Numbers & SMS/WhatsApp Messaging | USA/UK (Binding Corporate Rules & SCCs) |
| Stripe Payments UK, Ltd. | Payment Processing & Invoicing | United Kingdom |
| Resend Inc. | Transactional Email Delivery | USA (UK-US Data Bridge) |
5. Data Retention Periods
- Audio Recordings: Retained for 30 days, after which the audio file is automatically erased.
- Call Transcripts: Retained for 90 days, after which transcript text is redacted/deleted.
- Billing & Financial Records: Retained for 6 years in compliance with UK tax laws.
- Account Data: Retained for the duration of your active account, and deleted upon request.
6. Your Rights under UK GDPR
You have the right to access, rectify, erase (“right to be forgotten”), or port your personal data, and to restrict or object to certain processing. You may exercise these rights at any time by emailing hello@myreceptionist.uk.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.